Passive faraday mirror attack in practical two-way quantum key distribution system 
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The faraday mirror (FM) plays a very important role in maintaining the stability of two way 
plug-and-play quantum key distribution (QKD) system. However, the practical FM is imperfect, 
which will not only introduce additional quantum bit error rate (QBER) but also leave a loophole 
for Eve to spy the secret key. In this paper, we propose a passive faraday mirror attack in two way 
QKD system based on the imperfection of FM. Our analysis shows that, if the FM is imperfect, the 
dimension of Hilbert space spanned by the four states sent by Alice is three instead of two. Thus 
Eve can distinguish these states with a set of POVM operators belonging to three dimension space, 
which will reduce the QBER induced by her attack. Furthermore, a relationship between the degree 
of the imperfection of FM and the transmittance of the practical QKD system is obtained. The 
results show that, the probability that Eve loads her attack successfully depends on the degree of 
the imperfection of FM rapidly, but the QBER induced by Eve's attack changes with the degree of 
the imperfection of FM slightly. 

PACS numbers: 03.67.Hk, 03.67.Dd 
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I. INTRODUCTION 

Quantum key distribution (QKD) [Ij] admits two re- 
mote parties, known as Alice and Bob, to share uncon- 
ditional secret key, even the eavesdropper (Eve) has ul- 
timate power admitted by the quantum mechanics. Al- 
though the unconditional security have been proved for 
both the ideal system [2, Q and the practical system 
d, @ in past years, some assumptions are set to limit 
Eve's attack strategy or to ignore some imperfections ex- 
isted in the practical QKD system. Generally speaking, 
the practical QKD system is imperfect. Any deviation 
between the standard security analysis and the practi- 
cal QKD system will leave a loophole for Eve to obtain 
more information. In the worst case. Eve can exploit all 
these imperfections together to maximize her information 
about the secret key. Thus it is important to do research 
on the practical QKD system carefully and close these 
loopholes to guarantee the unconditional security of key. 
In fact, some potential attacks using the imperfection of 
a practical QKD system have been discovered, for exam- 
le, timing side channel attack !(|, faked states attack 
^^ blinding attac k tSj] , Trojan- horse attacks ^QiL time- 
shifted attack [13, [ill , phase-remapping attack [Tj, [T^ . 
Therefore, when the QKD system is used in the practi- 
cal situation, the legitimate parties should consider the 
potential attack according to any imperfection existed in 
the practical system and find defense strategies against 
them. 

In all the practical QKD system based on long distance 
fiber, the major difficulty is to maintain the stability and 
compensate the birefringence of fiber. In order to re- 
solve this problem, MuUer et al. proposed an interesting 
two-way plug-and-play scheme [ij], which can compen- 
sate the birefringence automatically. In this system, Bob 
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sends a strong reference pulse to Alice. Then Alice en- 
codes her information to the reference pulse, attenuates 
it to single photon level, and sends it back to Bob. Since 
the pulse travels back and forth in the quantum channel, 
the birefringence is compensated automatically. How- 
ever, since Alice admits the pulse go in and go out of 
her zone, it will leave a backdoor for Eve to implement 
variable Trojan- horse attack pj|-KL3|. 

In this paper, we propose a passive faraday mirror 
(PFM) attack in two way plug-and-play QKD system 
based on the imperfection of faraday mirror (FM) which 
plays a very important role in compensating the bire- 
fringence of fiber. Our results show that, for the BB84 
protocol [1], when the FM deviates from the ideal sit- 
uation, the dimension of Hilbert space spanned by the 
states sent by Alice is three instead of two. Thus it will 
give Eve more information to spy the secret key. When 
the legitimate parties are unaware of our attack, uncon- 
ditional security of the generated key must be compro- 
mised. Thus, in practical situation, it is very important 
for Alice and Bob to consider our attack when they judge 
whether the plug-and-play QKD system is secure or not. 

In the following, we first, in Sec|TT] and Sec lIIIl intro- 
duce the imperfection of FM and analyze a PFM attack 
based on this imperfection. In Sec lIVl we find the mini- 
mal QBER between Alice and Bob induced by Eve, when 
she uses an optimal and suboptimal POVM measurement 
strategy to implement the intercept-and-resend attack. 
In Sec|Vl we give a brief conclusion of this paper. 



II. THE IMPERFECTION OF FARADAY 
MIRROR 

In this section, we first introduce the two way plug- 
and-play system briefly, and show why the FM can be 
used to compensate the birefringence of fiber. Then we 
show how the imperfection of FM can be used by Eve to 
spy the secret key. 



Bob 



PM 



BS PBS^ 




^ b J j on / 



PM, 



'•. Att. 



FM 

Alice 



Eve 



Cir 



(a) 



c d 



PM 



ldq— (f^ I A A /'" pSffl 



Att. 



State 
Analysis 



FM 

Alice 



I (b) 



FIG. 1: (Color online)Tlie simple diagram of plug-and-play 
system [lj| and Eve's attack. LDilaser diode, Cir: circula- 
tor, BS: beam splitter, PBS: polarization beam splitter, Att. 
attenuator, PM: phase modulator, FM: faraday mirror, QC 
quantum channel, Dl and D2: single photon detector, PC 
polarization controller. Part(a) shows plug-and-play system 
without Eve. Part(b) shows Eve's PFM attack. In the dia- 
gram, we only show how Eve obtains the information of Alice, 
c and d are two time modes sent to Alice by Eve and we as- 
sume only mode c is modulated by Alice in this paper. 



A. Plug-and-play QKD system 

A simple diagram oi plug-and-play system [ij] without 
Eve is shown in FigjIJa). Bob sends a strong reference 
pulse to Alice, which is horizontally polarized. The pulse 
will be divided equally into two parts by a beam splitter 
(BS), noted as a and b. A polarization controller (not 
shown in Figll} is used to change the polarization of b 
to guarantee it can pass the polarization beam splitter 
(PBS) totally. Generally speaking, due to the birefrin- 
gence of fiber, the polarization of a and b are random, 
when they arrive at Alice's zone sequentially. However, a 
FM can be used to compensate the birefringence of chan- 
nel automatically. When a and b return Bob's zone, their 
polarization are orthogonal to that of their initial state. 
Then they will travel the other path and interfere in BS. 
Therefore, FM plays an important role in compensating 
the birefringence of fiber. Now, we show why the FM can 
do this. 

The FM is a combination of a 6* faraday rotator and 
an ordinary mirror. In ideal situation, 9 = 45° and the 
Jones matrix of FM can be written as: 
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Thus the polarization of the outgoing state is always 
orthogonal to that of the incoming state, regardless of 
the input polarization state. It is easy to prove that for 
any birefringence medium, the following equation always 
holds, that is: 

T{-e') ■ FM{45°) ■ T{0') = e'('^°+'^'')FM(45°), (2) 

where T{9') and T{—6') are the Jones matrices of bire- 
fringence medium when the photon travels forward and 
backward the quantum channel, which are given by: 
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where ipo, fe are the propagation phases of ordinary and 
extraordinary rays and 9' is the rotation angle between 
the reference basis and the eigenmode basis of the bire- 
fringence medium. Eq.([2]) shows clearly that, in the ideal 
situation, the plug-and-play system can compensate the 
birefringence of medium automatically. 

Here, we remark that although the plug-and-play sys- 
tem will suffer from the "untrusted source" problem in 
which the source incoming Alice's zone is controlled by 
Eve totally, the security has been rigorously proved in a 
few recent works p^| - [2(]| |. Thus, this problem is not con- 
sidered in this paper and the additional setups for Alice 
to monitor the "untrusted source" are also not shown in 
FigUl 



B. PFM attack 

In the discussion above, we have shown that, in the 
ideal situation, FM can be used to compensate the bire- 
fringence of fiber automatically. However, in practical 
case, the angle of the faraday rotator in FM is not exact 
45°. Then Eq.(IT|) is not valid and the Jones matrix of a 
practical FM should be rewritten as: 
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where 9 — 7r/4 -I- e is the angle of faraday rotator in a 
practical FM. Generally speaking, e is small. For exam- 
ple, in the center wavelengths 1550nm and ISlOnm, the 
maximal rotation angle tolerance is 1° (at 23°C ) for the 
popular FM produced by Newport [2l| and General Pho- 
tonics 22]. Thus, in this paper, we only consider the 
case that lei < 1°. 



When FM is imperfect, the birefringence of fiber can 
not be compensated totally and additional QBER will be 
induced. However, the additional QBER is just the minor 
bug of the practical FM, since e is very small. The major 
one is that the imperfection of FM will leave a loophole 
for Eve to spy the secret key. In the following, we show 
how Eve can use this imperfection, which is called PFM 
attack in this paper. 

The PFM attack is shown in part(b) of FigHJ In the 
diagram, we only draw the major part of Eve's attack 
that how Eve probes Alice's information. In order to do 
this, Eve sends two time modes c and d to Alice. Note 
that the two modes should be coherent , which can be 
obtained by splitting a pulse with a BS like the gener- 
ation of mode a and h sent by Bob. The polarization 
of the two modes should also be the same, which is con- 
trolled by Eve's polarization controller(PC). We assume 
the polarization state of photon that sent to Alice by Eve 
is given by: 



= [a P\ 



(5) 



Note that the polarization of incoming state is controlled 
by Eve totally, thus a and /3 are any complex number 
that satisfy |ap-|-|/3p = 1. Simply, we only consider the 
the special case that Eve sets a — 1 and /3 = in this 
paper. 

It is easy to prove that the Jones vectors of output 
polarization state for the two time modes can be written 
as: 
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where outc and outd are the Jones vectors of mode c and 
mode d. Here we assume that only c is modulated by 
Alice, k = 0,1,2,3 are the indices of the four states 
modulated by Alice. S is the phase difference between 
states, in the standard BB84 scheme, S — tt/2, but if Eve 
combines our attack with the phase-remapping attack 
[H [il, (5 e [0,7r/2]. Note that, in Eq.® and Eq.©, 
we assume that Eve can compensate perfectly the bire- 
fringence of Alice's zone by controlling her polarization 
controller. Although it is still challenging as the bire- 
fringence at Alice's side fluctuates, we can ignore this 
fluctuation, since the interval that Eve's photon incom- 
ing and outgoing Alice's zone is much smaller than the 
time for a remarkable fluctuation of the birefringence. 

Therefore, when FM is imperfect, the states sent by 
Alice are not the standard BB84 state which are noted 
as \(j)k) = (e^'^'/^lc) -I- \d))/V^, but four new states that 
can be written as: 



1 



$fc) = -^{sin{2e)e'^'"'\cH) + cos{2e)e"'''\cV) 
v2 

+ sin{2e)\dH) + cos{2e)\dV)} . 



(8) 



It is easy to check that, when e 7^ 0, the dimension of 
Hilbert space spanned by the four new states of Eq.® 
is three. In order to show it clearly, we let \H) = 
cos[2e)\H') -f sin{2e)\V') and \V) = -sin{2e)\H') + 
cos[2e)\V'), and note \cH') = |eo), \cV') = |ei), \dV') = 
|e2). Note that e can be known by Eve exactly, thus the 
transformation from {H, V} to {if', V'} can be imple- 
mented by Eve. Then Eq.(8) can be rewritten as: 

+ [szn2(2e)e*2M ^ cos\2e)e'''%i) + jes)}. 

Eq.® and Eq.® show clearly that the information 
encoded by Alice appears not only in the time mode (c 
and d), but also in the polarization mode [H and V). Ob- 
viously, Eve can obtain more information from the four 
new states than the four standard BB84 states. Thus if 
Alice and Bob are unaware of the imperfection of FM, 
it will leave a loophole for Eve to spy the information 
encoded by Alice. Here, we remark that, although the 
true states sent by Alice is shown by Eq.®, Eve can 
not get more information from Eq.® than Eq.®, since 
the transformation from Eq.® to Eq.® is just one uni- 
tary operation which can not give her more information. 
Thus, in the following, we use Eq.® but not Eq.® to 
continue our discussion. 



III. PFM ATTACK BASED ON AN 
INTERCEPT-AND-RESEND ATTACK 

When FM is imperfect, the states sent by Alice are 
not the standard BB84 states but the states shown by 
Eq.(l9]). Thus, Eve can use the operators belonging to 3- 
dimension Hilbert space to measure the four states. Note 
that, for the case that FM is perfect, the operators that 
can be used by Eve should be limited in 2-dimension 
Hilbert space. Generally speaking, when a new imper- 
fection of system is found by Eve, she can combine all 
imperfections of the system and attack strategies to max- 
imize her information of the key. However, in this paper, 
we only consider the intercept-and-resend attack, which 
shows clearly that the generated key will be compromised 
due to the imperfection of FM. 

We consider the following attack. Eve intercepts each 
pulse returned from Alice's zone and measures it with 
five POVM operators {AUac, Mi\i = 0, 1, 2, 3} which sat- 
isfy the condition that Myac + Si=o -^^* ~ ^- When Eve 
obtains the outcome corresponding to Af^, she resends a 
standard BB84 state |0i) to Bob. Here we add an ad- 
ditional POVM operator Myac, since Eve needs not to 
resend all the pulses to Bob due to the loss of channel 
between Alice and Bob. Thus when she obtains the out- 
come corresponding to this operator, she blocks the pulse 
and sends a vacuum state to Bob. Obviously, the above 
attack is the same as the general intercept-and-resend at- 
tack. However, in our attack, the dimension of Mi and 
Myac is three instead of two. 



Obviously, Eve can not distinguish the four states \^k) 
certainly, since they are linearly dependent states. In the 
following, we estimate the QBER between Alice and Bob 
induced by Eve. According to the measurement theory, 
the conditional probability that Bob obtains \<j>j) given 
that Alice sends the state |$fe) is given by: 



P{j\k) = Yl ^^^ = -^1-^ = *)^(-^ = *l^ = '^^ 
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where P{B = j\E — i) is the conditional probability 
that Bob obtains \4>j) given that Eve resends the state 
|(/)i), P{E = i\A = k) is the conditional probability that 
Eve obtains outcome corresponding to Mi given that 
Alice sends |$fc), pk = |$fc)($fc|- Note the fact that 



li^^mi' 



3j+2j- 



(S. 



i+lj" 



3i+3j 
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kronecker delta function. Therefore, the QBER between 
Alice and Bob induced by Eve's attack is given by: 



where 



EloTriM^p) 



^ 1 1 

P = P0 + Pi + P2 + P3- 
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Generally speaking, the optimal strategy for Eve is to 
find a set of optimal POVM operators to minimize the 
QBER es- Although Eq.dlT]) is the same as Eq.[3] of 
Ref.[i4| formally, the dimension of POVM operators is 
three in our attack instead of two in Ref.[l2l- Further- 
more, in Ref[l2l, the authors remark that "the constraint 
Si=o -^* < / is not necessary to minimize e^, since 
any solution to this unconstrained problem can always 
be scaled down sufficiently to satisfy the constraint". 
This conclusion is also true in our case. However, we 
remark that although the constraint J2i=o ^i — ^ ^'^^^ 
not change the QBER, it will bound the probability that 
Eve obtains an valid outcome successfully, here the valid 
outcome means that Eve obtains outcome corresponding 
to Mi but not Myac- The probability that Eve obtains 
an outcome successfully is also an important parameter 
to describe Eve's attack, which is given by: 



1 ^ 
PFucc = jY.^r{M.,p), 



(13) 



j=0 



where the division by four is that Alice sends one of the 
four states with equal probability. 



Therefore, in order to find the optimal strategy for 
Eve, she needs to solve the optimization program with 
two penalty functions, which can be written as: 
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where Mi > and M-^ac > mean the matrix Mi and 
Myac are positive. In fact Eve can not obtain the optimal 
value of the two penalty functions simultaneous, which 
will be shown in the following. Thus, in the following, 
we consider the QBER e^ as the major object and P, 
as a minor one. 



E 
succ 



IV. SIMULATION 

According to the above analysis, the optimal strategy 
for Eve is given by the solution of Ea.([Ti)). However, it is 
hard to find the global optimal solution of Eq. (|T4l) [26| . 
Thus, in this paper, our analysis follows the method of 



Fung et al. [12|, who uses this method to analyze the 



security of QKD system for the phase-remapping attack. 
In this section, we first introduce the method of Fung 
and then estimate the QBER between Alice and Bob 
with numerical simulation. We remark that, although 
the method considered here is just suboptimal for Eve, 
it shows clearly that the secrecy of generated key will be 
compromised by our PFM attack. The numerical simula- 
tions show that, under PFM attack, the QBER between 
Alice and Bob induced by Eve is lesser than 25% which 
is the QBER under the general intercept-and-resend at- 
tack. Furthermore, when Eve combines our attack with 
the phase remapping attack, the QBER induced by her 
attack can be lesser than 11%, which is the maximal tol- 
erable QBER under the collective attack |23j . 



A. The suboptimal strategy for Eve 

According to Ref. J^j , the suboptimal strategy can be 
described as: 

Step one: Instead of distinguishing the four states sent 
by Alice, here Eve only distinguishes po from {pi, P2,P3} 
and p3 from {pQ, pi, p2}. It means that, Eve uses three 
POVM operators {MyacMojM^} to measure the states 
sent by Alice. When she obtains the outcome correspond- 
ing to Mo or AI3, she resends a standard BB84 state \(j)o) 
or 103) to Bob, otherwise, she resends a vacuum state 
to Bob. It can also be considered as a special case of 
the intercept-and-resend attack described in Sec lIIII that 
A/i = M2 = 0. 

Step two: Instead of finding the global optimal POVM 
operators to minimize e^. Eve uses the following POVM 
operators to measure the states sent by Alice, which are 



given by: 



M3 = xp 



-"^\c,){c,\p-"^ 



(15) 



where |Co) or 

„-l/2r „-l/2 



IC3) is the eigenvector of matrix 
or p~^''^L^p^^i^ corresponding to the min- 
imal un-zero eigenvalue Aq or A3, x is the maximal real 
number that ensure the matrix M^ac — I ~ Mq — M^ 
is positive. Obviously, {M^acT^Q^M^} are positive and 
sum to the identity, thus they are valid POVM operators. 

Here we give two remarks about this suboptimal strat- 
egy for Eve. 

Remark one: Although the global solution of Eq.([T4]) 
is not obtained in this paper, it does not matter, since our 
goal is to show the loophole caused by the imperfection 
of FM, but not to try to give a strict security analysis. 
Thus if we can find a set of POVM operators that can 
show this loophole, it is enough. If Eve who has unlimit 
computation power wants to optimize her strategy, she 
can solve the optimization program. 

Remark two: In the suboptimal strategy described 
above. Bob only obtains bit in one basis and bit 1 
in other basis. Glancingly, it will give Alice and Bob a 
simple method to defeat our attack, since they only need 
to estimate the count rate of bit and bit 1 for each ba- 
sis individually. However, we remark that, the method 
can only defeat our suboptimal strategy, but can not de- 
feat a optimal attack caused by the imperfection of FM. 
In fact, the suboptimal strategy is just a toy model to 
show the security loophole induced by the imperfection 
of FM. This suboptimal strategy is also used by Fung et 
al. in the phase remapping attack to obtain their main 
conclusion (Fig. (4) of Ref . |12|| ) . If a true Eve exists, she 
can solve the optimal programme Eq. (jl4l) and find the 
optimal strategy for her. Then, the probability that Bob 
obtains bit and bit 1 is equal in two base. 



B. Result 

Substituting the suboptimal POVM operators Eq.([T5]) 
into Eq. pT]) and Eq. p^ . it is easy to estimate the QBER 
for Bob, e^, and the probability that Eve obtains out- 
come successfully, Pfucc- Since Eve can combines the 
phase remapping attack [12l | with our attack, we set the 
phase difference 5 G [0, it/2] in the following discussion. 
Here, we remark again that the following results are ob- 
tained based on the suboptimal strategy described above. 
If Eve can find the global solution of Eq. p^ , she can im- 
prove the following results. Furthermore, note that e = 
is a singular point in PFM attack, since, in this point, the 
dimension of Hilbert space spanned by the four states of 
Eq.® is reduced to two. It means that Eve can not 
implement our attack in this point. Thus, this point is 
excluded in the following simulation. 

FigUl shows clearly the probability that Eve obtains 
outcome successfully, P^^c changes with e for given S. 
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FIG. 2: (Color online)The probability that Eve obtains out- 
come successfully changes with e for given 5. The fours lines 
are obtained by maximizing x of Ea. (|15() . Note that the 
special point that e = is unconsidered in our simulation. 
Since this point is a singular point, in which the dimension of 
Hilbert space spanned by the four states of Eq.® is reduced 
to two. Thus our attack is invalid in this point. 



The larger e is, the easier Eve can load her attack. Here, 
we remark that Pf^cc can be explained as the maximal 
transmittance of channel between Alice and Bob that Eve 
can load this attack successfully under the suboptimal 
strategy for given e and <5 [271]. For example, when e = 1 
and (5 = 7r/2, Pf^^^ = 2.43 x 10^^. It means that if Eve 
wants to implement this attack successfully, the trans- 
mittance of channel between Alice and Bob should be 
smaller than 2.43 x 10^"^, which corresponds to a 124km 
long fiber (the typical loss of fiber is about 0.21 dB/km). 
Furthermore, Pf^^^f^c. '"^'^ ^^'^ be explained as that, for a 
given transmittance of channel. Eve can not exploit the 
imperfection of FM that e is smaller than a given value. 
For example, when 8 — 11/2 and |e| < 0.65°, P^^^^c i^ 
smaller than 1.029 x 10~^. Thus for a 142.5km long fiber 
(the transmittance is about 1.017 x 10^"^), Eve can not 
exploit the imperfection of FM that |e| < 0.65°. 

The QBER between Alice and Bob induced by Eve's 
attack is shown in Fig|3l It shows that even in the case 
that 5 — it/2, the QBER induced by Eve's attack is much 
lower than 25% which is QBER induced by the general 
intercept-and-resend attack. It is also lower than 20%, 
which is the maximal tolerable QBER in the BB84 proto- 
col under the two-way post-processing [2J, [23 when Eve 
does not exploit the imperfection of FM. Furthermore, if 
Eve combines the phase-remapping attack with our at- 
tack, she can reduce the QBER to a very small level. 
For example, if Eve sets the phase difference 5 = tt/S, 
the QBER induced by her attack is just 3.57%, which 
is lower than 11% that is the maximal tolerable QBER 
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FIG. 3: (Color online)The error rate of Bob changes with e for 
given S. Note that, due to the same reason as Fig[2] the spe- 
cial point that e = is also unconsidered here. Furthermore, 
we combine the phase remapping attack with our attack, thus 
S can be smaller than it/2. 



for the BB84 protocol under the collective attack and 
one-way post-processing [23] . Then no secret key can be 
generated when the QBER estimated by Alice and Bob is 
larger than this value. Therefore, it is necessary for the 
legitimate parties to consider our attack in a practical 
plug-and-play QKD system. 

It is interesting that, when S is given, the QBER in- 
duced by Eve is almost constant and independent of the 
degree of the imperfection of FM e, which is shown in 
FigO] clearly. The main reason is that e is very small. In 
fact, e^ will changes with e slightly, but the difference is 
so small that it can be ignored. In order to show the con- 
clusion clearly, we consider Ea. dTTj) with o{e^). It is easy 
to check that, under the suboptimal strategy of Eg. dTSt . 
e = (Ao+A3)/2, here, Aq and A3 are the minimal un-zero 
eigenvalue oi p^^^'^Lop^^^^ and p^^^^L^p^^^^. A simple 
evolution show that, when 6 = 7r/2, the three eigenval- 
ues of p-^/^Lnp-^^^ are 1/2, (1 ± %/2/2)(l - 2e)/2. Thus 
Ao = (l-V^/2)(l-2e)/2 = 0.1464- 0.2929e. The same 
result can be obtained for A3. Therefore, the error rate of 
Bob induced by Eve can be written as e^ = 0.1464-|-o(£), 
which shows clearly that e^ is constant in order of o(e). 
In fact, the strict nunrerical simulation shows that, for 
given S, e^ is almost constant in order of 10~^ for each 
e. Note that, although e^ is almost independent of e, e 
will affect P^^c obviously (see Figl2]). 

Fig [3] shows that when Eve combines the phase remap- 
ping attack with the imperfection of FM, the QBER in- 
duced by her attack can be reduced to a very small level. 
For example, when she sets S — 7r/4, the QEER is just 
4.72%. However, when the QBER is reduced, the prob- 
ability that Eve implements her attack successfully will 
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FIG. 4: (Color online) The probability that Eve obtains out- 
come successfully changes with S for the phase remapping 
attack and our attack. The red line is obtained for the 
phase remapping attack according to the method described 
in Ref. [l2l. The blue and green lines are obtained for e = 1° 
and e = 0.5°, respectively. 



also be reduced, see Figl5] Therefore, when Eve loads her 
attack, she should make a trade-off between the QBER 
and the efficiency to maximize her information. 

In the following, we compare our attack with the phase 
remapping attack 12]. The probability that Eve obtains 
outcome successfully is shown in FigU) It shows that 
the probability that Eve implements the phase remap- 
ping attack successfully is much larger than that of our 
attack. Although Eve can increase the probability that 
she implements her attack successfully by increasing the 
phase difference S, it will induce more QBER which is 
shown in FigjSJ 

Fig[S] shows that, when the phase difference 6 is in- 
creased, the QBER induced by Eve's attack will increase 
quickly. This conclusion holds for both the phase remap- 
ping attack and our attack. However, the QBER under 
our attack is much lower than that of the phase remap- 
ping attack. For example, when S — n/A, e^ — 17.7% 
for the phase remapping attack, but in our attack, e^ = 
4.71%. 



V. CONCLUSION 

In the two-way plug-and-play QKD system, a perfect 
90° FM can be used to compensate the birefringence of 
fiber automatically and perfectly. However, the practi- 
cal FM is imperfect. Although the deviation from the 
ideal case is small and the QBER induced by this imper- 
fection is slight, it will leave a loophole for Eve to spy 
the secret key between Alice and Bob. In fact, when the 
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FIG. 5: (Color online)The error rate of Bob changes with 
5 for the phase remapping attack and PFM attack. In the 
simulation, we set e = 1°. 



practical FM deviates from the ideal case, the dimension 
of Hilbert space spanned by the states sent by Alice is 
three instead of two. Thus the standard security analysis 
is invalid here, some careful strategy should be adopted 
by the legitimate parties to monitor this imperfection. 
In this paper, we propose a PFM attack in two way 



plug-and-play QKD system based on the imperfection 
of FM. The results show that, under this attack, the 
QBER between Alice and Bob induced by Eve is much 
lower than 25%, which is the QBER for the general 
intercept-and-resend attack when FM is perfect. Fur- 
thermore, when Eve combines the imperfection of FM 
with phase remapping attack, the QBER induced by her 
attack can be lower than 11%, which is the maximal tol- 
erable QBER for the BB84 protocol under the collective 
attack and one-way post-processing. Therefore, in the 
practical case, the legitimate parties should pay more at- 
tention to the imperfection of FM, otherwise, the secrecy 
of generated key will be compromised. However, we re- 
mark that, although Eve can combine PFM attack with 
phase-remapping attack to reduce QBER between Alice 
and Bob induced by her attack, the probability that she 
can load this attack successfully is dependent on the loss 
of channel obviously. In other words. Eve can only imple- 
ment PFM attack in long distance QKD system, which 
can be estimated in Figl5] and FigHl 
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